terraform

Codify Terraform and OpenTofu infrastructure governance with modular best practices.

9|1|Updated Feb 1, 2026

Search Tags:#infrastructure #modules #terraform #iac #state-management #opentofu

Ready to run

npx skills add https://github.com/calcosmic/Aether --skill terraform-calcosmic

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: terraform
Source: https://github.com/calcosmic/Aether/tree/main/.aether/skills-codex/domain/terraform
Command: npx skills add https://github.com/calcosmic/Aether --skill terraform-calcosmic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps teams manage infrastructure as code with Terraform or OpenTofu by enforcing best practices and robust workflows, reducing misconfigurations and drift across environments.

Core Features & Use Cases

Organize code into reusable modules: modules/{resource-type}/ with main.tf, variables.tf, outputs.tf
Use the module block to compose infrastructure: pass inputs via variables, expose outputs for downstream use
Follow the principle of one module per logical resource group (e.g., vpc, database, eks-cluster)
Version modules with git tags or registry versions: source = "git::https://...?ref=v1.2.0"
Use locals for computed values and transformations; avoid complex logic inside resource blocks

State Management

Store state remotely: use S3+DynamoDB (AWS), Azure Blob (Azure), or GCS (GCP) with locking enabled
Never commit .tfstate to version control -- it contains sensitive outputs
Use state encryption for sensitive deployments; configure in the backend block
Run terraform plan before every apply; review the diff carefully for destructive changes
Use terraform import to bring existing resources under Terraform management without recreation

Workspace Strategies

Use Terraform workspaces for environment separation (dev/staging/prod) with identical configurations
Map workspace names to environment-specific variables via terraform.workspace in locals
For large-scale separation, prefer separate state files per environment over workspaces
Label resources with workspace tags: Environment = terraform.workspace for cost tracking

Provider Configuration

Pin provider versions with required_providers block: version = "~> 4.0"
Use provider aliases for multi-region or multi-account deployments
Pass provider credentials via environment variables or IAM roles -- never hardcode in .tf files
Use dynamic blocks for repeatable nested configurations: security group rules, IAM policies

Testing and Validation

Run terraform validate and terraform fmt in CI before every merge
Use tflint for linting beyond built-in validation: detect unused variables, deprecated syntax
Write Terratest integration tests for critical infrastructure: terraform.InitAndApply + assertions
Use check blocks (Terraform 1.3+) for custom data assertions without external tools
Implement terraform plan as a PR check; post the plan diff as a comment for review

Quick Start

Initialize your Terraform/OpenTofu project with a modular structure and apply the first module to provision infrastructure.

Frequently Asked Questions about terraform

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I structure Terraform modules for multi-environment deployments?▼

Structure Terraform modules by placing each logical resource group, like vpc or database, into a dedicated modules/{resource-type}/ directory containing main.tf, variables.tf, and outputs.tf. Compose infrastructure by passing inputs via variables and exposing outputs for downstream use.

What is the best way to manage remote state in Terraform across cloud providers?▼

Manage Terraform remote state by storing it in S3 with DynamoDB for AWS, Azure Blob, or GCS with locking enabled. Never commit .tfstate files to version control because they contain sensitive outputs, and use state encryption for sensitive deployments.

Should I use Terraform workspaces or separate state files for environment separation?▼

Use Terraform workspaces for dev, staging, and prod environments with identical configurations, mapping workspace names to variables via terraform.workspace. For large-scale environment separation, prefer using separate state files over workspaces to isolate state.

Does OpenTofu work with the same module composition and state management practices as Terraform?▼

OpenTofu works with the same infrastructure as code practices, applying module composition, remote state security, provider pinning, and validation workflows across cloud providers just like Terraform. It supports multi-environment deployments and modular architectures.

How do I validate Terraform configurations and test infrastructure in CI?▼

Validate Terraform configurations by running terraform validate and terraform fmt in CI before every merge. Use tflint to detect unused variables and deprecated syntax, and write Terratest integration tests using terraform.InitAndApply with assertions for critical infrastructure.

Why should I pin provider versions and avoid hardcoding credentials in Terraform?▼

Pin provider versions using the required_providers block to prevent breaking changes, and pass provider credentials via environment variables or IAM roles to secure sensitive data. Hardcoding credentials in .tf files exposes secrets and creates security vulnerabilities.